CVE-2018-25229
Published: 30 March 2026
Summary
CVE-2018-25229 is a medium-severity Assumed-Immutable Data is Stored in Writable Memory (CWE-1282) vulnerability in Bpftpserver Bulletproof Ftp Server. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2018-25229 is a denial of service vulnerability in BulletProof FTP Server version 2019.0.0.50, specifically within the SMTP configuration interface. Local attackers can crash the application by supplying an oversized string, such as a buffer of 257 'A' characters in the SMTP Server field, followed by clicking the Test button. The vulnerability is associated with CWE-1282 and has a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
The attack requires local access to the system with no privileges needed, though it demands user interaction to input the malicious string and trigger the test. Successful exploitation results in an application crash, denying service to the FTP server functionality.
References include the vendor sites at http://bpftpserver.com/ and http://bpftpserver.com/products/bpftpserver/windows/download, along with an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/46422 and a Vulncheck advisory at https://www.vulncheck.com/advisories/bulletproof-ftp-server-denial-of-service-via-smtp. No specific patch or mitigation details are provided in the CVE description; security practitioners should consult these advisories for any recommended updates or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21716
Vulnerability details
BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the SMTP configuration interface that allows local attackers to crash the application by supplying an oversized string. Attackers can input a buffer of 257 'A' characters in the SMTP…
more
Server field and trigger a crash by clicking the Test button.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow in SMTP config UI enables application crash, directly mapping to application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the core vulnerability by enforcing validation of oversized inputs in the SMTP Server configuration field to prevent application crashes.
Requires timely identification, reporting, and remediation of the buffer overflow flaw in BulletProof FTP Server, eliminating the vulnerability through patching.
Ensures the application handles oversized string inputs and errors gracefully without crashing, mitigating the denial-of-service impact.